Add one-command mock services demo

Author: sl5-guy

.dockerignore

@@ -0,0 +1,7 @@
+/.git
+/.cursor
+/target
+/certs
+/logs.txt
+/*.log
+/*.jsonl

README.md

@@ -20,21 +20,35 @@ sudo apt-get install libtss2-dev swtpm tpm2-tools pkg-config
 ## Quick start
 
 ```bash
-./demo/generate-server-certs.sh       # server CA + gateway cert under certs/
-cp config.example.toml config.toml    # edit to taste
-docker compose -f docker-compose.postgres.yml up -d
-export AGENT_GATEWAY_DATABASE_URL=postgres://agent_gateway_admin:agent_gateway_dev@localhost:5432/agent_gateway
-psql "$AGENT_GATEWAY_DATABASE_URL" -f migrations/0001_signed_authorization_registry.sql
+./demo/setup.sh
 ```
 
-`demo/generate-server-certs.sh` only creates **server** TLS material (`server-ca.pem`, `server.pem`, ...). The local demo enrolls with `./demo/demo-agent.sh`, which starts a local `swtpm`, creates a persistent P-256 signing key in that simulated TPM, and prepares `machine-client.pem` as a certificate carrier for that public key and identity extension. The gateway does not trust a client CA bundle; it authorizes the exact subject public key recorded in signed Postgres permission rows.
+The setup script generates demo TLS material, creates `config.toml` when needed,
+starts Postgres and static HTTPS mock services with Podman Compose or Docker Compose, applies the
+database migration, builds and starts the gateway, enrolls a demo principal,
+grants access to `docstore` and `messaging`, creates a demo agent handle, and
+verifies that Claude Code can fetch `https://docstore/health` through the
+gateway.
+
+`demo/generate-server-certs.sh` creates gateway TLS material (`server-ca.pem`,
+`server.pem`, ...) and mock HTTPS service TLS material (`mock-ca.pem`,
+`mock-services.pem`, ...). The local demo enrolls with `./demo/demo-agent.sh`,
+which starts a local `swtpm`, creates a persistent P-256 signing key in that
+simulated TPM, and prepares `machine-client.pem` as a certificate carrier for
+that public key and identity extension. The gateway does not trust a client CA
+bundle; it authorizes the exact subject public key recorded in signed Postgres
+permission rows.
 
-Typical first-time flow:
+`demo/setup.sh` keeps its tpm2-pkcs11 state under the demo state directory by
+default. Override `AGENT_GATEWAY_DEMO_TPM2_PKCS11_STORE` only when you
+intentionally want the demo principal to use another store.
 
-1. `./demo/generate-server-certs.sh` and `cp config.example.toml config.toml`.
-2. Enroll a trusted principal signing key and grant its destination delegation scope.
-3. The principal creates an agent handle; the script prepares the subject certificate, signs permission rows for its exact SPKI DER, and starts the sidecar.
-4. Start the gateway (`cargo run -- --config config.toml`) before sending prompts through the sidecar.
+After setup, prompt the demo agent:
+
+```bash
+./demo/demo-agent.sh prompt agent-alpha \
+  --prompt "Access https://docstore/documents using curl"
+```
 
 On later runs, start the gateway first and use `./demo/demo-agent.sh prompt`. `./demo/connect.sh` prepares `machine-client.pem` for the current simulated TPM key and identity extension whenever it prepares or starts the sidecar. `--regenerate-certs` creates a fresh simulated TPM state; any permissions for the old subject key will no longer match.
 
@@ -110,30 +124,26 @@ Register a principal signing key from the TPM owner machine with:
 
 The script creates or reuses a non-exportable TPM-backed P-256 key through `tpm2_ptool` and PKCS#11, stores only the public key in `principal_signing_keys`, and uses the friendly `key_id` (`org-alice`, `org-bob`, etc.) for the registry row. Run it on the machine that owns the TPM, with `AGENT_GATEWAY_DATABASE_URL` or `DATABASE_URL` pointing at Postgres.
 
-For the demo, use three windows:
+For a manual demo without `./demo/setup.sh`, use three windows:
 
 ```bash
 # Principal shell: enroll the principal TPM public key.
 ./registry-cli/register-principal-key.sh org-alice
 
 # Admin shell: grant destination delegation authority to that principal.
-./registry-cli/grant-principal-scope.sh org-alice api.anthropic.com example.com
+./registry-cli/grant-principal-scope.sh org-alice docstore messaging api.anthropic.com
 
 # Principal shell: create a local agent handle with initial signed permissions.
 AGENT_HANDLE="$(./demo/demo-agent.sh create \
   --identity agent-alpha \
-  --grant api.anthropic.com)"
+  --grant docstore \
+  --grant messaging)"
 
 # Principal shell: send the first prompt through that agent.
-./demo/demo-agent.sh prompt "$AGENT_HANDLE" --prompt "test prompt"
-
-# Principal shell: grant another destination, then continue the same Claude session.
-./demo/demo-agent.sh grant "$AGENT_HANDLE" --grant example.com
-./demo/demo-agent.sh prompt "$AGENT_HANDLE" --prompt "now try the second destination"
+./demo/demo-agent.sh prompt "$AGENT_HANDLE" \
+  --prompt "Access https://docstore/documents with curl."
 ```
 
-The dashboard runs separately and observes Postgres plus OpenTelemetry. `demo-agent.sh` keeps gateway connection details out of the principal-facing command; set `AGENT_GATEWAY_DEMO_GATEWAY` and `AGENT_GATEWAY_DEMO_GATEWAY_CA` only when overriding the local defaults. `AGENT_GATEWAY_DEMO_GATEWAY_CA` is the CA for the gateway's server certificate, not a client trust root. The first prompt uses `claude -p`; later prompts for the same handle use `claude -c -p` from the handle's working directory.
-
 ## Authorization Registry
 
 The gateway authorizes a CONNECT only when all of these checks pass:

demo/connect.sh

@@ -206,16 +206,19 @@ run_prompt() {
     PROXY_URL="$(<"$proxy_file")"
     WORK_DIR="${WORK_DIR:-$STATE_DIR/work}"
     mkdir -p "$WORK_DIR"
+    CLAUDE_CURL_PERMISSIONS=(
+        --allowedTools "Bash(curl *)"
+    )
 
     if [[ -f "$STATE_DIR/claude_started" ]]; then
         (
             cd "$WORK_DIR"
-            HTTP_PROXY="$PROXY_URL" HTTPS_PROXY="$PROXY_URL" claude -c -p "$PROMPT"
+            HTTP_PROXY="$PROXY_URL" HTTPS_PROXY="$PROXY_URL" CURL_CA_BUNDLE="${CURL_CA_BUNDLE:-}" SSL_CERT_FILE="${SSL_CERT_FILE:-}" claude "${CLAUDE_CURL_PERMISSIONS[@]}" -c -p "$PROMPT"
         )
     else
         (
             cd "$WORK_DIR"
-            HTTP_PROXY="$PROXY_URL" HTTPS_PROXY="$PROXY_URL" claude -p "$PROMPT"
+            HTTP_PROXY="$PROXY_URL" HTTPS_PROXY="$PROXY_URL" CURL_CA_BUNDLE="${CURL_CA_BUNDLE:-}" SSL_CERT_FILE="${SSL_CERT_FILE:-}" claude "${CLAUDE_CURL_PERMISSIONS[@]}" -p "$PROMPT"
         )
         : > "$STATE_DIR/claude_started"
     fi

demo/demo-agent.sh

@@ -7,6 +7,8 @@ STATE_ROOT="${AGENT_GATEWAY_DEMO_STATE_DIR:-${XDG_STATE_HOME:-$HOME/.local/state
 DEFAULT_VALID_DAYS="${AGENT_GATEWAY_PERMISSION_VALID_DAYS:-30}"
 DEFAULT_GATEWAY="${AGENT_GATEWAY_DEMO_GATEWAY:-127.0.0.1:8443}"
 DEFAULT_GATEWAY_CA="${AGENT_GATEWAY_DEMO_GATEWAY_CA:-$REPO_ROOT/certs/server-ca.pem}"
+DEFAULT_MOCK_CA="${AGENT_GATEWAY_DEMO_MOCK_CA:-$REPO_ROOT/certs/mock-ca.pem}"
+DEFAULT_SIDECAR_BIN="${AGENT_GATEWAY_DEMO_SIDECAR_BIN:-}"
 DEFAULT_LISTEN_HOST="${AGENT_GATEWAY_DEMO_LISTEN_HOST:-127.0.0.1}"
 DEFAULT_LISTEN_PORT="${AGENT_GATEWAY_DEMO_LISTEN_PORT:-3128}"
 DEFAULT_SWTPM_PORT="${AGENT_GATEWAY_DEMO_SWTPM_PORT:-2321}"
@@ -25,6 +27,8 @@ Usage:
 Environment:
   AGENT_GATEWAY_DEMO_GATEWAY defaults to 127.0.0.1:8443.
   AGENT_GATEWAY_DEMO_GATEWAY_CA defaults to certs/server-ca.pem.
+  AGENT_GATEWAY_DEMO_MOCK_CA defaults to certs/mock-ca.pem for Claude HTTPS requests.
+  AGENT_GATEWAY_DEMO_SIDECAR_BIN can pin the sidecar binary used by start-sidecar.
   AGENT_GATEWAY_DEMO_STATE_DIR overrides the local agent handle directory.
   AGENT_GATEWAY_PERMISSION_VALID_DAYS defaults to 30.
   TPM2_PKCS11_STORE defaults to $HOME/.tpm2_pkcs11.
@@ -150,17 +154,24 @@ sidecar_running() {
 
 ensure_sidecar() {
   local dir="$1"
+  local args=(
+    start-sidecar
+    --state-dir "$dir"
+    --gateway "$GATEWAY"
+    --gateway-ca "$GATEWAY_CA"
+    --extension-value "$IDENTITY"
+    --listen "$LISTEN"
+    --swtpm-port "$SWTPM_PORT"
+  )
   if sidecar_running "$dir"; then
     return
   fi
 
-  "$SCRIPT_DIR/connect.sh" start-sidecar \
-    --state-dir "$dir" \
-    --gateway "$GATEWAY" \
-    --gateway-ca "$GATEWAY_CA" \
-    --extension-value "$IDENTITY" \
-    --listen "$LISTEN" \
-    --swtpm-port "$SWTPM_PORT" >&2
+  if [[ -n "$DEFAULT_SIDECAR_BIN" ]]; then
+    args+=(--sidecar-bin "$DEFAULT_SIDECAR_BIN")
+  fi
+
+  "$SCRIPT_DIR/connect.sh" "${args[@]}" >&2
 }
 
 prepare_subject_certificate() {
@@ -261,6 +272,15 @@ cmd_prompt() {
 
   [[ -n "$PROMPT" ]] || { echo "error: prompt requires --prompt" >&2; exit 2; }
   ensure_sidecar "$STATE_DIR_CURRENT"
+  [[ -f "$DEFAULT_MOCK_CA" ]] || {
+    echo "error: mock service CA file not found: $DEFAULT_MOCK_CA" >&2
+    echo "hint: run ./demo/generate-server-certs.sh or ./demo/setup.sh first" >&2
+    exit 1
+  }
+  export NODE_EXTRA_CA_CERTS="$DEFAULT_MOCK_CA"
+  export CURL_CA_BUNDLE="$DEFAULT_MOCK_CA"
+  export SSL_CERT_FILE="$DEFAULT_MOCK_CA"
+  export CLAUDE_CODE_PROXY_RESOLVES_HOSTS="${CLAUDE_CODE_PROXY_RESOLVES_HOSTS:-1}"
   "$SCRIPT_DIR/connect.sh" prompt \
     --state-dir "$STATE_DIR_CURRENT" \
     --work-dir "$STATE_DIR_CURRENT/work" \

demo/gateway.Dockerfile

@@ -0,0 +1,12 @@
+FROM rust:1-bookworm AS builder
+
+WORKDIR /src
+COPY . .
+RUN cargo build --release --bin agent_gateway
+
+FROM debian:bookworm-slim
+
+COPY --from=builder /src/target/release/agent_gateway /usr/local/bin/agent_gateway
+WORKDIR /workspaces/agent_gateway
+
+ENTRYPOINT ["agent_gateway"]

demo/generate-server-certs.sh

@@ -1,26 +1,56 @@
 #!/usr/bin/env bash
-# Demo gateway server TLS only: certs/server-ca*.pem and certs/server*.pem.
+# Demo TLS material: gateway server certs plus mock HTTPS service certs.
 
 set -euo pipefail
 
 DIR="certs"
 
 mkdir -p "$DIR"
 
-echo "==> Generating server CA"
-openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 \
-    -keyout "$DIR/server-ca-key.pem" -out "$DIR/server-ca.pem" \
-    -days 365 -nodes -subj "/CN=agent-gateway server CA" 2>/dev/null
-
-echo "==> Generating gateway server cert (localhost / 127.0.0.1)"
-openssl req -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 \
-    -keyout "$DIR/server-key.pem" -out "$DIR/server.csr" \
-    -nodes -subj "/CN=localhost" 2>/dev/null
-openssl x509 -req -in "$DIR/server.csr" \
-    -CA "$DIR/server-ca.pem" -CAkey "$DIR/server-ca-key.pem" -CAcreateserial \
-    -out "$DIR/server.pem" -days 365 \
-    -extfile <(printf 'subjectAltName=DNS:localhost,IP:127.0.0.1') 2>/dev/null
-rm -f "$DIR/server.csr" "$DIR/server-ca.srl"
+have_files() {
+    local file
+    for file in "$@"; do
+        [[ -f "$file" ]] || return 1
+    done
+}
+
+if have_files "$DIR/server-ca-key.pem" "$DIR/server-ca.pem" "$DIR/server-key.pem" "$DIR/server.pem"; then
+    echo "==> Using existing gateway server certs"
+else
+    echo "==> Generating server CA"
+    openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 \
+        -keyout "$DIR/server-ca-key.pem" -out "$DIR/server-ca.pem" \
+        -days 365 -nodes -subj "/CN=agent-gateway server CA" 2>/dev/null
+
+    echo "==> Generating gateway server cert (localhost / 127.0.0.1)"
+    openssl req -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 \
+        -keyout "$DIR/server-key.pem" -out "$DIR/server.csr" \
+        -nodes -subj "/CN=localhost" 2>/dev/null
+    openssl x509 -req -in "$DIR/server.csr" \
+        -CA "$DIR/server-ca.pem" -CAkey "$DIR/server-ca-key.pem" -CAcreateserial \
+        -out "$DIR/server.pem" -days 365 \
+        -extfile <(printf 'subjectAltName=DNS:localhost,IP:127.0.0.1') 2>/dev/null
+    rm -f "$DIR/server.csr" "$DIR/server-ca.srl"
+fi
+
+if have_files "$DIR/mock-ca-key.pem" "$DIR/mock-ca.pem" "$DIR/mock-services-key.pem" "$DIR/mock-services.pem"; then
+    echo "==> Using existing mock service certs"
+else
+    echo "==> Generating mock service CA"
+    openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 \
+        -keyout "$DIR/mock-ca-key.pem" -out "$DIR/mock-ca.pem" \
+        -days 365 -nodes -subj "/CN=agent-gateway mock service CA" 2>/dev/null
+
+    echo "==> Generating mock service cert (docstore / messaging)"
+    openssl req -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 \
+        -keyout "$DIR/mock-services-key.pem" -out "$DIR/mock-services.csr" \
+        -nodes -subj "/CN=agent-gateway mock services" 2>/dev/null
+    openssl x509 -req -in "$DIR/mock-services.csr" \
+        -CA "$DIR/mock-ca.pem" -CAkey "$DIR/mock-ca-key.pem" -CAcreateserial \
+        -out "$DIR/mock-services.pem" -days 365 \
+        -extfile <(printf 'subjectAltName=DNS:docstore,DNS:messaging\nextendedKeyUsage=serverAuth') 2>/dev/null
+    rm -f "$DIR/mock-services.csr" "$DIR/mock-ca.srl"
+fi
 
 echo ""
 echo "Generated in $DIR/:"

demo/mock/Caddyfile

@@ -0,0 +1,25 @@
+{
+	auto_https off
+}
+
+docstore:443 {
+	tls /certs/mock-services.pem /certs/mock-services-key.pem
+	header Content-Type application/json
+
+	respond /health `{"status":"ok","service":"docstore"}` 200
+
+	respond /documents `{"documents":[{"id":"handbook","title":"Employee Handbook","summary":"Demo employees can find travel, device, and security policies here."},{"id":"incident-runbook","title":"Incident Runbook","summary":"Page the on-call lead, create a channel, and post status updates every 30 minutes."}]}` 200
+
+	respond `{"error":"not_found","service":"docstore"}` 404
+}
+
+messaging:443 {
+	tls /certs/mock-services.pem /certs/mock-services-key.pem
+	header Content-Type application/json
+
+	respond /health `{"status":"ok","service":"messaging"}` 200
+
+	respond /messages `{"messages":[{"from":"alice","channel":"demo-ops","text":"Quarterly planning starts at 2pm."},{"from":"bob","channel":"demo-ops","text":"Please review the incident runbook before the tabletop."}]}` 200
+
+	respond `{"error":"not_found","service":"messaging"}` 404
+}